VLSI Reverse Engineering via Scan Test Interface
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Reconstructing a circuit logic model for a VLSI device is a complex and costly process that requires expensive equipment and tedious work, especially in reverse engineering, and existing methods are invasive and resource-intensive.
Innovation Solution
A method and system that utilize a scan test interface to switch between scan shift and functional modes, mapping logic function patterns through probe iterations to generate a circuit logic model by analyzing combinatorial logic, reducing the number of probe iterations and computation resources using heuristic algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional reverse engineering methods are used to reconstruct circuit logic models, then complete logic functionality can be obtained, but the process requires expensive equipment and is extremely time-consuming
Solution Approach 1:
The patent extracts only the essential information needed for logic model reconstruction by utilizing the scan test interface to directly access internal register states and logic function patterns. This extraction approach avoids the need for expensive invasive equipment while obtaining sufficient data to reconstruct the circuit logic model efficiently
Solution Approach 2:
The patent creates a logical copy of the circuit's behavior by mapping logic function patterns through probe iterations. Instead of physically dissecting or invasively measuring the device, the method reconstructs the logic model by copying the functional relationships between inputs, registers, and outputs through systematic probing
2Loss of information
If exhaustive probing methods are used to map all logic function patterns, then complete circuit description is extracted, but the number of probe iterations becomes extremely large
Solution Approach 1:
The patent employs feedback mechanisms where each probe iteration uses the results from previous iterations to guide subsequent probing. The logic state information obtained from registers and external pins feeds back into the mapping process, allowing the system to intelligently determine which logic function patterns have been covered and which still need to be probed, thereby reducing redundant iterations
Solution Approach 2:
The patent applies partial action by mapping logic function patterns selectively rather than exhaustively probing every possible combination. By using heuristic algorithms to identify and prioritize significant logic function patterns, the method achieves sufficient circuit description completeness with fewer probe iterations than a complete exhaustive approach would require
3Use of energy by moving object
If scan test interface is exploited for mapping logic patterns, then computation resources are reduced, but the method requires switching between scan shift mode and functional mode
Solution Approach 1:
The patent utilizes periodic switching between scan shift mode and functional mode in a structured sequence. The method alternates between these two modes in probe iterations, systematically transitioning from scan shift mode (for accessing internal registers) to functional mode (for probing external pins and observing logic function patterns). This periodic action allows efficient exploitation of the scan test interface while managing mode switching complexity through systematic organization
Data Source
AI summary
A computerized method of creating a circuit logic model of a VLSI device, comprising mapping a plurality of logic function patterns of one or more circuits of a VLSI device through a plurality of probe iterations and generating a circuit logic model of the circuit(s) by reconstructing a logical function of a combinatorial logic of the circuit(s) based on analysis of the logic function patterns. Each of the probe iteration comprises switching between scan shift mode and functional mode of the VLSI device such that while the VLSI device operates in scan shift mode register(s) associated with the circuit(s) is accessed and while the VLSI device operates in functional mode external pin(s) of the VLSI device associated with the circuit(s) is probed and mapping a respective one of the logic function patterns according to a logic state of one or more bits in the register(s) and/or the external pin(s).